BaseFortify

Publication date: 2025-11-20

Last updated on: 2025-11-24

Assigner: IBM Corporation

Description

IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-20

Last Modified

2025-11-24

Generated

2026-07-07

AI Q&A

2025-11-20

EPSS Evaluated

2026-07-06

NVD

CVE-2025-36161

EUVD

EUVD-2025-198299

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	concert	From 1.0.0 (inc) to 2.1.0 (exc)
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-327	The product uses a broken or risky cryptographic algorithm or protocol.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM Concert versions 1.0.0 through 2.0.0 is due to the failure to properly enable HTTP Strict-Transport-Security (HSTS). Because of this, a remote attacker could perform man-in-the-middle attacks to obtain sensitive information from users communicating with the affected system.

Impact Analysis

The vulnerability can allow an attacker to intercept and obtain sensitive information by exploiting the lack of proper HTTP Strict-Transport-Security enforcement. This could lead to exposure of confidential data without the user's knowledge.

Hi! I’m here to help you understand CVE-2025-36161. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70